Joint Controllership Agreement for AV Betting Sales Agreements
1. Definitions and Interpretations
1.1. For the purposes of this Agreement, capitalized terms shall have the following meanings, unless defined elsewhere in the Agreement or in the Main Agreement:
“Agreement” shall mean this Joint Controllership Agreement;
“Business Day” shall mean any day except any Saturday, Sunday or a public holiday in the respective countries of incorporation of the Parties to this Agreement;
“CCPA” shall mean the US California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) and from time to time;
“Competent Data Protection Authority” shall mean the competent data protection authority;
“Data Protection Legislation” means all applicable data protection legislation, including the GDPR, the CCPA/CPRA, any national or state data protection legislation, and any regulations, guidelines or any other documents issued by a Competent Data Protection Authority, each as amended from time to time;
“GDPR” means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as amended from time to time;
“Main Agreement” has the meaning given to it in clause 2.1 of this Agreement;
“Shared Personal Data” has the meaning given to it in clause 3 of this Agreement.
1.2. For the purposes of this Agreement, the terms controller”, “business”, “joint controllers”, “independent controllers”, “business”, “processor”, “service provider”, “data subject”, “consumer”, “personal data”, “process”, “processing” and “data breach” shall have the meanings attributed to them in the Data Protection Legislation.
2. Purpose of the Agreement
2.1. The purpose of this Agreement is to determine the roles and responsibilities of each Party during the provision of the Internet and Mobile Live Streaming Rights for online betting purposes under the Licensing Agreement (the “Main Agreement”) in order to ensure the Parties’ compliance with the applicable Data Protection Legislation.
2.2. The Parties acknowledge that they shall be considered joint data controllers under the GDPR and/or businesses under the CCPA regarding the Shared Personal Data.
3. Shared Personal Data
3.1. The Parties shall have joint controllership over the following types of personal data of the following categories of data subjects in the course of their business relationship:
a. IP addresses of end users of the Licensee,
b. Geographical coordinates (if applicable) of end users of the Licensee,
c. Unique client-side IDs (Unikey) of end users of the Licensee,
d. User agent strings of end users of the Licensee,
e. Log files and client-facing APIs which may contain personal data of end users of the Licensee,
f. IP addresses, names, email addresses, user IDs, usernames of Licensee´s employees,
(the “Shared Personal Data”)
3.2. The processing of Shared Personal Data shall consist of and is necessary in order to:
a. verify that an end user is from an allowed country or subdivision or region of a country; to create stream-token; to troubleshoot API-integration enquires,
b. classify which country, subdivision or region of a country an end user streams from; to calculate the number of streaming sessions; to troubleshoot support cases where an end user repeatedly experienced issues; to debug situations with high error rate, repeated failures to play streams, or where fraud is taking place,
c. understand how the content is consumed, i.e. to monitor the success rate for the playback of the streams; standard viewing analytics to monitor traffic, country distribution and (if applicable) countriesꞌ subdivision distribution, volume, etc.; to support Licensee support requests,
d. perform internal researches and analysis about an end user’s streaming experience,
e. manage access to Sportradar’s portals and to create and provide changelogs with auto booking rules and history,
f. perform fraud detection and prevention.
3.3. The Parties shall process the Shared Personal Data for the purpose of the provision of the services under the Main Agreement.
3.4. The Licensee acknowledges and agrees, that Sportradar shall have the right to use de-identified and/or aggregated data related to or obtained in connection with the Main Agreement for its legitimate internal business purposes, such as analytics, reporting, and to improve, benchmark and develop its internal products and services.
4. Term
4.1. This Agreement shall commence on the effective date of the term of the Main Agreement and shall continue in full force and effect until the expiry or termination for any reason of the Main Agreement (i.e. this Agreement shall continue in full force and effect until the expiry or termination for any reason of the last licensing agreement for the provision of Internet and Mobile Live Streaming Rights for online betting purposes concluded between the Parties) on which date this Agreement shall automatically terminate without liability.
4.2. Upon termination of the Agreement the Parties shall proceed in accordance with clause 5.8 of this Agreement.
5. Obligations of the Parties
5.1. Rights of the Data Subjects
5.1.1. The Parties shall cooperate, as set out below in this clause 5.2. of this Agreement, with respect to data subjects’ requests to exercise rights under the Data Protection Legislation, including but not limited to:
a. right to access, rectification, erasure and object;
b. right to restriction of processing;
c. right to data portability;
d. right not to be subject to a decision based solely on automated means;
e. right to opt out of the sale or sharing of the personal information.
5.1.2. The Licensee shall respond to any data subject requests concerning the Shared Personal Data and shall forward any such requests and any information on any actions with respect to such requests to Sportradar without undue delay and in any event withing 72 hours. In the event that Sportradar receives any data subject requests concerning the Shared Personal Data, Sportradar shall forward such requests to the Licensee for a response to the data subjects.
5.1.3. Sportradar shall provide reasonable and prompt assistance to the Licensee (within 5 (five) Business Days of such request for assistance) as is necessary to enable the Licensee to comply with data subject requests and to respond to any other queries or complaints of any kind whatsoever from data subjects.
5.1.4. The Parties to this Agreement shall maintain a record of data subject requests, the decisions made and any information that was exchanged. Records shall include copies of the request for information, details of the personal data accessed and shared and where relevant, notes of any meetings, correspondence or phone calls relating to the request.
5.2. Information Duty
The Licensee shall, at the time of collection of the Shared Personal Data, inform the data subjects about the personal data collection and processing under this Agreement. The Licensee shall, in respect of the Shared Personal Data, ensure that (i) its privacy notices are clear and provide sufficient information to data subjects in order for them to understand what of their personal data is collected and shared, the circumstances in which it will be shared, the purposes for the data sharing, including adding reference to Sportradar as an entity with whom the Shared Personal Data is shared in its privacy statements, (ii) shall obtain any consent (where necessary) of data subjects as required by the GDPR and any other applicable Data Protection Legislation and (iii) shall immediately communicate to Sportradar in writing if the data subjects withdraw their consents.
5.3. Processors
The Parties to this Agreement may use one or more processors/service providers provided that each of them shall comply with any applicable Data Protection Legislation.
5.4. Data Protection Impact Assessment
Upon request, the Parties shall provide each other reasonable cooperation and assistance needed to carry out a data protection impact assessment (if applicable) in accordance with the Data Protection Legislation related to the processing of the Shared Personal Data under this Agreement.
5.5. Records
Both Parties to the Agreement shall at their own cost keep a record of any processing of Shared Personal Data they carry out.
5.6. Complaints
In the event of a dispute or claim brought by a data subject or a Competent Data Protection Authority concerning the processing of Shared Personal Data against either or both Parties, the Parties shall inform each other about any such disputes or claims without delay and shall cooperate with a view to settling them amicably in a timely manner.
5.7. Data Security
5.7.1. Both Parties to the Agreement shall implement appropriate technical and organisational measures to:
a. ensure a level of security appropriate to the risk involved to protect all Shared Personal Data from unauthorized use, alteration, access or disclosure, and loss, theft, and damage;
b. ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c. restore the availability and access to Shared Personal Data in a timely manner in the event of a physical or technical incident;
d. test, assess and evaluate the effectiveness of technical and organisational measures implemented for ensuring the security of the processing of the Shared Personal Data;
e. pseudonymise and encrypt the Shared Personal Data, as appropriate;
f. prevent a personal data security breach.
5.7.2. Both Parties to the Agreement shall keep accurate records of the security measures which they have in place and shall make such records available to the other Party upon request.
5.8. Personal Data After Termination
5.8.1. Both Parties acknowledge and agree that after the termination of the Main Agreement, each Party shall delete the Shared Personal Data in accordance with its retention schedule.
5.8.2. In the event that the Licensee receives any data subject requests concerning the processing of the Shared Personal Data by Sportradar after the termination of the Main Agreement, the Licensee shall forward such requests to Sportradar for a response to the data subjects.
5.9. Data Breach
The Parties to this Agreement shall notify the other Party of any potential or actual accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Shared Personal Data as soon as possible and, in any event, within 3 (three) Business Days of identification of any potential or actual loss in order to consider what action is required to resolve the issue in accordance with the Data Protection Legislation.
5.10. Confidentiality
5.10.1. Both Parties shall maintain the duty of secrecy regarding the Shared Personal Data, even after the termination of the Main Agreement.
5.10.2. Both Parties guarantee that the individuals authorised to process Shared Personal Data expressly undertake in writing to respect confidentiality and to comply with the relevant security measures, of which they must be duly informed.
5.10.3. Both Parties shall not disclose Shared Personal Data to third parties, unless with the express prior written consent of the other Party or when legally required. For the avoidance of doubt, Parties’ processors/service providers, affiliates and/or subsidiaries shall not be considered as third parties.
6. Liabilities
6.1. The Licensee shall indemnify and shall keep Sportradar indemnified from and against all costs, claims, fines, losses, damages or expenses incurred by Sportradar, or for which Sportradar may become liable, due to any failure by the Licensee to comply with any of its obligations set out in this Agreement. For the avoidance of doubt, this indemnity shall be unlimited and shall override any limitation of liability provisions agreed by the Parties in the Main Agreement or in any other agreement.
6.2. To the fullest extent permitted by law, neither Sportradar nor any of its affiliates, shall be liable to the Licensee under or in connection with this Agreement for any indirect, special or consequential losses or damages, loss of business or good will, profit or revenue. Sportradar´s total aggregate liability to the Licensee under or in connection with this Agreement, whether the liability arises because of a breach of contract, negligence or for any other reason, shall be strictly limited to the amount of fees actually paid by the Licensee under the Main Agreement during the 12 (twelve) months preceding the event giving rise to the damages.
7. Contact Point
Sportradar nominates the following contact person within its organisation who can be contacted in respect of queries, complaints or notifications of any kind whatsoever regarding this Agreement or the Data Protection Legislation:
For the Sportradar:
Name and position: Stefano Celardo (Data Protection Officer)
Tel.: +43 1 256 31 41 548
E-mail: [email protected]
For the Licensee:
As per the Main Agreement
8. Miscellaneous
8.1. In the event of any conflict between the terms of this Agreement and any provision of the Main Agreement and any other agreement between the Parties, this Agreement shall take precedence. For the avoidance of doubt and if applicable, Parties acknowledge and agree that this Agreement shall replace any and all previously concluded data processing agreement(s) that regulate(s) Parties’ data protection relationship and their respective obligations regarding processing of personal data in relation to the Main Agreement.
8.2. This Agreement shall be governed by and construed in accordance with the Austrian laws. All disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the Austrian court(s).
8.3. Clause 5.2, 5.8.1, 5.8.2, and 6 of this Agreement shall survive the termination or the expiry of this Agreement and the Main Agreement.
8.4. The provisions of this Agreement are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision and the rest of this Agreement shall remain in full force and effect.
8.5. Any amendment to this Agreement must be made in writing upon mutual agreement by the Parties. For the purpose of this Agreement “writing”, “in writing” and “written” includes handwritten signatures, signatures produced by mechanical or digital means (such as by stamp, print, copy, scan, digitally scanned and stored signature inserted into [digital] document, etc.) as well as qualified electronic signatures. Also, for the avoidance of doubt, transmission/exchange in electronic format (for example scanned documents sent by email) do fulfil the form requirement. The written form requirement in this clause may only be waived by respecting the same written form requirement.
